Description
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node’s default unhandled-rejection behavior this can terminate the process.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.8.0, <= 5.9.2
- Patched version(s): 5.9.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion - Vulnerability
- devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation - Vulnerability
- devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated - Vulnerability
- devalue: Repeated primitive strings cause quadratic expansion in uneval - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 01, 2026